Security method and system for storage subsystem

ABSTRACT

According to the present invention, techniques for performing security functions in computer storage subsystems in order to prevent illegal access by the host computers according to logical unit (LU) identity are provided. In representative embodiments management tables can be used to disclose the Logical Unit in the storage subsystem to the host computers in accordance with the users operational needs. In a specific embodiment, accessibility to a storage subsystem resource can be decided when an Inquiry Command is received, providing systems and apparatus wherein there is no further need to repeatedly determine accessibility for subsequent accesses to the Logical Unit. Many such embodiments can maintain relatively high performance, while providing robust security for each LU.

CROSS-REFERENCES TO RELATED APPLICATIONS

This present application is a continuation application of U.S. Ser. No.11/330,261, filed Jan. 12, 2006, which is a continuation of applicationSer. No. 10/737,477, filed Dec. 15, 2003, now U.S. Pat. No. 7,024,410;which is a continuation of application Ser. No. 09/561,404, filed Apr.27, 2000, now U.S. Pat. No. 6,684,209 and claims priority from JapanesePatent Application Reference No. P00-010115, filed Jan. 14, 2000, theentire disclosures of all of the above-identified applications arehereby incorporated by reference.

BACKGROUND OF THE INVENTION

The present invention relates generally to storage subsystems, and inparticular to techniques for providing access to Logical Units within astorage subsystem by host computers.

Conventionally, security methodologies designed to prevent an illegalaccess to a storage subsystem by host computers depend on the functionsof OS (Operating System), middleware or application software on the hostside.

On the other hand, as the fibre channel protocol has been standardizedin recent years, the various standard protocols such as SCSI, ESCON, andTCP/IP have become available to be used as the interface between thehost computers and the storage subsystem, resulting in more and moreefficient use of the storage resources within the storage subsystem.

However, because more than one host computer accesses one storagesubsystem, the traditional security approaches that depend on operatingsystem (OS), middleware, or application software on the host computerside, are increasingly recognized as providing insufficient security forthe resources in modem storage subsystems.

What is really needed are techniques for performing security functionsin computer storage subsystems connected to one or more host computersvia high performance channel interfaces.

SUMMARY OF THE INVENTION

According to the present invention, techniques for performing securityfunctions in computer storage subsystems in order to prevent illegalaccess by the host computers according to logical unit (LU) identity areprovided. In representative embodiments management tables can be used todisclose the Logical Unit in the storage subsystem to the host computersin accordance with the users operational needs. In a specificembodiment, accessibility to a storage subsystem resource can be decidedwhen an Inquiry Command is received, providing systems and apparatuswherein there is no further need to repeatedly determine accessibilityfor subsequent accesses to the Logical Unit. Many such embodiments canmaintain relatively high performance, while providing robust securityfor each Logical Unit.

In a representative embodiment according to the present invention, acomputer system is provided. The computer system can comprise a varietyof components, such as one or more host computers and one or morestorage subsystems. Each storage subsystem can comprise one or morelogical units, for example. A data channel can interconnect the hostcomputers with the storage subsystem. The host computers can requestavailability of one or more of the logical unit in one of the storagesubsystems. Such request can comprise identity information correspondingto the particular host computer, and a virtual logical unit identifierof the logical unit, the availability of which is being requested. Inresponse, the storage subsystem determines whether the requesting hostcomputer may permissibly access the logical unit requested based uponthe virtual logical unit identifier and the identity information fromthe request.

In specific embodiments of the computer system, identity informationcorresponding to the one or more host computers further comprises adynamically assignable identifier. The storage subsystem determines aunique identifier for the one or more host computers from the identityinformation in the request; and then determines whether the hostcomputer requesting access may permissibly access the logical unit basedupon the virtual logical unit identifier and the unique identifier.

In another representative embodiment according to the present invention,a storage subsystem is provided. The storage subsystem can comprise amanagement table that defines relationships among the information WWNwhich uniquely identifies the accessing host computer, a Logical UnitNumber (LUN) in the storage subsystem which the host computer ispermitted to access, and a Virtual Logical Unit Number (Virtual LUN)which is created from the LUN identifiers in any way of numbering inaccordance with user's convenience. Specific embodiments can alsoinclude a management table that defines the linkages between aManagement Number (S_ID) dynamically assigned by the storage subsystemto identify a host computer, and a World Wide Name (WWN) which uniquelyidentifies the accessing host computer. The management tables can bestored in a non volatile memory, for example. Some specific embodimentscan comprise more than one storage unit, and the like. A storage controlunit to control the read/write operations from/to said storage units canalso be part of the storage subsystem. Specific embodiments can alsoinclude more than one communication port to connect to a plurality ofhost computers, and Logical Units corresponding to the storage areas insaid storage units.

In a specific embodiment according to the present invention, in thestorage subsystem, the assigned S_ID is used as an identity informationof the host computer instead of the WWN. Such embodiments do not requirechecking the accessibility to the LUN each time an I/O operation isexecuted, resulting in less overhead in each I/O operation. Also, usersare free to rearrange LUNs in any desired way by making use of theVirtual LUNs.

In a further representative embodiment according to the presentinvention, the storage subsystem retrieves an identity information, suchas the Company_ID, that is common to a certain group of host computers,partially from the WWN. By performing the accessibility control on thebasis of the group having the common identity information, the storagesubsystem provides the host computer with storage resource format,application, service, and specific pressing valid only for thatparticular host computer group.

Numerous benefits are achieved by way of the present invention overconventional techniques. The present invention can provide the securityfunctions that prevent illegal accesses by limiting accessibility ofLogical Units by each host computer, without additional modification ofthe current operation of the host computer. Many embodiments can alsoprovide the security function to prevent illegal accesses by limitingaccessible Logical Units according to each vendor of the host computers,without additional modification of the current operation on the hostcomputer side. Further, select embodiments according to the presentinvention can provide permission to access storage resources based onsecurity functions to host computer groups. Such permission can beaccording to vendor, and service can be specifically tailored for thegroup. Specific embodiments can provide highly efficient use of thestorage resources and fast accessibility judgment logic.

These and other benefits are described throughout the presentspecification. A further understanding of the nature and advantages ofthe invention herein may be realized by reference to the remainingportions of the specification and the attached drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates a representative hardware configuration in which thepresent invention may be readily embodied;

FIG. 2 illustrates a representative Frame Format and Frame Header in aparticular embodiment of the present invention;

FIG. 3 illustrates the Frame Format, Frame Header and a Data Field in aparticular embodiment of the present invention;

FIG. 4 illustrates a representative LOGIN process in a particularembodiment of the present invention;

FIG. 5 illustrates a representative Frame format for transmitting anInquiry Command in a particular embodiment of the present invention;

FIG. 6 illustrates a representative format for Inquiry Data used whentransferring Inquiry Data responsive to the Inquiry Command which isshown in FIG. 5;

FIG. 7 illustrates a representative sequence for inquiring about theaccessibility of a Logical Unit using an Inquiry Command in a particularembodiment of the present invention;

FIG. 8 illustrates an outline of a representative processing sequencefor the LUN Security in a particular embodiment of the presentinvention;

FIG. 9 illustrates an “LUN Access Management Table” in a particularembodiment of the present invention;

FIG. 10 illustrates a format of an incomplete “LUN Access ManagementTable” which will arise when the present invention is not applied;

FIG. 11 illustrates the condition shown in FIG. 10;

FIG. 12 illustrates another example in which a format of an incomplete“LUN Access Management Table” which will can arise when the presentinvention is not applied;

FIG. 13 illustrates the condition shown in FIG. 12;

FIG. 14 illustrates a representative format of a “LUN Access ManagementTable” in a particular embodiment of the present invention;

FIG. 15 illustrates a representative format of the “LUN AccessManagement Table” in a particular embodiment of the present invention;

FIG. 16 illustrates a representative technique for providing LUNSecurity in a particular embodiment of the present invention;

FIG. 17 illustrates a representative sequence to create the “LUN AccessManagement Table” in a particular embodiment of the present invention;

FIG. 18 illustrates a representative sequence to create a “WWN-S_IDConversion Table” in a particular embodiment of the present invention;

FIG. 19 illustrates a representative format for a “WWN-SID ConversionTable” in a particular embodiment of the present invention;

FIG. 20A illustrates a representative sequence to judge theaccessibility of a LUN as a response to an Inquiry Command transferredfrom a host computer for providing LUN Security in a particularembodiment of the present invention;

FIG. 20B illustrates a representative sequence to judge theaccessibility of LUN as a response to an Inquiry Command transferredfrom a host computer for providing LUN Security in a particularembodiment of the present invention;

FIG. 21 illustrates relations among information in a plurality of tablesfor providing LUN Security in a particular embodiment of the presentinvention;

FIG. 22 illustrates an example of the WWN format in a particularembodiment of the present invention;

FIG. 23 illustrates a representative format of a “LUN Access ManagementTable” for controlling access based upon a vendor identity in aparticular embodiment of the present invention;

FIG. 24 illustrates an outline of a representative processing sequencefor providing LUN Security based upon a vendor identity in a particularembodiment of the present invention;

FIG. 25 illustrates relations among information in a plurality of tablesfor providing LUN Security based upon vendor identity in a particularembodiment of the present invention;

FIG. 26 illustrates a representative format of a “LUN Access ManagementTable” for controlling access based upon a vendor identity in aparticular embodiment of the present invention; and

FIG. 27 illustrates a representative technique for providing LUNSecurity according to vendor identity in a particular embodiment of thepresent invention.

DESCRIPTION OF THE SPECIFIC EMBODIMENTS

The present invention provides techniques for performing securityfunctions in computer storage subsystems in order to prevent illegalaccess by the host computers according to logical unit (LU) identity. Inrepresentative embodiments management tables can be used to disclose theLogical Unit in the storage subsystem to the host computers inaccordance with the users operational needs. In a specific embodiment,accessibility to a storage subsystem resource can be decided when anInquiry Command is received, providing systems and apparatus whereinthere is no further need to repeatedly determine accessibility forsubsequent accesses to the Logical Unit. Many such embodiments canmaintain relatively high performance, while providing robust securityfor each Logical Unit.

According to one example of storage subsystem access security, beforethe host computer is started, the storage subsystem establishes a tablewhich manages the combination of an accessible Logical Unit in thestorage subsystem and N_Port_Name. The N Jort_Name uniquely identifiesthe host computer which may access the storage subsystem. When the hostcomputer is started, it issues a SCSI command consisting of aninformation unit called a frame which is specified by the fibre channelprotocols. The storage subsystem checks details each time this SCSIcommand is received and extracts the N Port Name which identifies theaccessing host computer.

The extracted N_Port_Name is searched for in a combination table of theLogical Units and said N_Port_Names, and when an expected entry exists,the host computer is permitted to access the Logical Unit. Otherwise,when no associated entry exists, the host computer is refused access tothe Logical Unit. For a detailed description of one example of asecurity-means for a storage subsystem resource (the Logical Unit),reference may be had to a Japanese unexamined patent application,publication 10333839, the entire contents of which are incorporatedherein by reference for all purposes.

The present invention is explained with reference to specificembodiments employing a fibre channel as an interface protocol between astorage subsystem and host computers, and the SCSI command set as acommand interface operational under the interface protocol, as examples.However, the application of the present invention is not limited to thecombination of the fibre channel and SCSI command set. Any protocolwhich provides similar function and structure of LOGIN, Inquiry, and thelike may apply techniques according to the present invention.

In a representative embodiment according to the present invention, afibre channel protocol is employed as an interface between storagesubsystem and one or more host computers. Because the fibre channel is arelatively new interface protocol, details of a representativeembodiment employing fibre channel protocol will be outlined herein.

The fibre channel protocol utilizes serial type of data transfer and canmake use of the band width of the transmission medium effectivelybecause of the asynchronous transfer method. The fibre channel doesn'thave its own command set and instead adopts the command sets such as theSCSI, ESCON, HIPPI, IPI-3, IP and so on, as its command setinfrastructure. Therefore, it is possible to inherit the traditionalprotocol resources and to realize faster, more reliable, and versatiledata transfer.

The fibre channel is an interface having characteristics of both of socalled Channel Interface and Network Protocols. In the fibre channel,once the transferring unit and receiving unit are fixed, high speed datatransferring is available with the least transferring delay. Thisfeature can provide a desirable data transfer rates in specificembodiments using such channel interfaces.

Also, any unit who wants communication can enter into a communicationover the network on any optional occasion and can initiate thecommunication by exchanging agreement information about communicationconditions with another unit. These are some of the characteristics ofsuch networks. The procedure to reach agreement about the communicationcondition with another unit, as described above, is specifically calledLOGIN.

A unit that interfaces with the fibre channel is called a node and aphysical entrance of the node, that is, the actual interface, is calleda port. A node can have one or more ports. The number of the ports whichcan participate simultaneously in the whole system of the fibre channelis defined by the number of 24-bit addresses, i.e., about 16,770,000maximum in a particular embodiment. The hardware which mediates theseconnections is called fabric. Actually, however, both transferring andreceiving ports are not required to be aware of the fabric, they areneed only operate according to the information exchanged with eachother.

The identifier, which is unique all over the world, is allocated basedon a consistent rule by the standardization group (IEEE), and ismaintained in each node and port. This identifier is equivalent to theMAC address traditionally used in the TCP/IP and so on and the addressinformation is fixed by hardware. This address comprises of twocomponents of N_Port_Name and Node_Name, and each has a size of 8 bytesrespectively, in a representative embodiment. The N_Port_Name is aspecific value (the hardware address) corresponding to each port and theNode_Name is also a specific value (the hardware address) correspondingto each node. Because each of them is an unique value all over the worldand can address a port or a node uniquely, it is called WWN (World WideName). In specific embodiments of the present invention, when the WWN isreferred to, it means the N_Port_Name.

In the fibre channel, a communication is executed by exchanging a signallevel information called an Ordered Set and a logical information havingfixed format called a frame. FIG. 2 shows a representative structure ofa frame. A frame block 201 comprises of, an SOF (Start of Frame) 202 of4 bytes, for example, which indicates a start of the frame, a FrameHeader 203 of 24 bytes, for example, which controls Link Operation andcharacterizes the frame, a Data Field 204 which contains the actual datato be transferred, a Cyclic Redundancy Code (CRC) 205 of 4 bytes, forexample, and an EOF (End of Frame) 206 of 4 bytes, for example, whichindicates the end of the frame. The length of the Data Field 204 isvariable between 0-2112 bytes, for example.

Next, the contents of the Frame Header are explained. Table 207illustrates the structure of a representative Frame Header. Here, anS_ID 208, which comprises the 0 bit to 23 bit area of the first word ofthe detailed structure 207 in the Frame Header 203, is explained. TheS_ID (Source ID) 208 is the address of 3 bytes, for example, thatidentify the port which transfers the frame, and has a value effectivewithin all frames sent and received. This SID is a dynamically assignedvalue and is specified to be allocated by the fabric during theinitialization procedure in the case of FC_PH, which is one of thestandard sets of the fibre channel. The allocated value depends on theN_Pott_Name or Node_Name which each port has.

Next, the LOGIN procedure, with which the transferring unit andreceiving unit exchange information about the communication with eachother based on the fibre channel protocol, is explained. FIG. 3 showsthe detailed structure of a representative Data Field 303 of a PLOGIframe. The structures of the frame and Frame Header are the same as thatof FIG. 2. Among the Data Field 303 of the PLOGI frame, the 8-byte areafrom the 21 st byte to the 29th byte stores the N_Port_Name 307 and the8-byte area from the 30th byte to the 38th byte stores the Node_Name308, for example.

FIG. 4 shows an exchange of the information between a transferring unit(LOGIN requesting unit) 401 and a receiving unit (LOGIN receiving unit)402. Several kinds of LOGIN procedures exist in the fibre channel,however, the Class 3 LOGIN procedure is described here as an example.

A LOGIN requesting unit transfers the PLOGI frame 403 to a LOGINreceiving unit. In this frame are included the N_Port Name, Node Name,SID and the other information belonging to the LOGIN requesting unit.The LOGIN receiving unit transfers a frame which is called ACC 404 tothe LOGIN requesting unit, if the receiving unit accepts the LOGIN afterchecking the information contained in the frame. On the other hand, ifthe LOGIN is rejected, the receiving unit transfers a frame which iscalled LS Rif 405 to the LOGIN requesting unit.

When the LOGIN requesting unit receives the ACC frame as a response tothe PLOGI frame transferred by itself, it understands that the LOGIN hassucceeded and it is placed in the status ready for initiating the I/Oprocess for the data transfer and so on. On the other hand, when itreceives LS_RTT, the LOGIN has not succeeded and the LOGIN requestingunit may not proceed to I/O process with the LOGIN receiving unit. Here,the LOGIN process of Class 3 is explained, but regarding the other LOGINprocesses, it is similar in that the N_Port Name, Node_Name and SID arecontained in the information can be transferred to the LOGIN receivingunit from the LOGIN requesting unit.

Next, an Inquiry Command, which is supported as a standard command inthe SCSI command set, is explained. Preceding the initiation of I/Oprocess, the Inquiry Command is used to inquire the status of a LogicalUnit to be an object of the succeeding I/O process, such as installationstatus or ready status.

FIG. 5 shows a detailed diagram of a representative structure of theData Field used when the Inquiry Command specified by the SCSI standardis transferred using a frame specified by the fibre channel standard.The structures of the frame and Frame Header are similar to those shownin FIG. 2, however, included in the Data Field is the SID 505 for theLOGIN requesting unit stored by the LOGIN receiving unit during thepreceding PLOGI sequence before this frame is transferred.

In the data field 503, there is an area called FCP_LUN 507, FCP_CNTL508, FCP_CDB 509, and FCP_DL 510 as shown in the FCP_CMND format 506.FCP LUN 507, and FCP CDB 509 will be described hereafter. The identifierof the logical volume is contained in FCP_LUN 507. The logical volume isrelated to a port that receives a frame, and also, the status of suchlogical volume is requested to be sent to a node which sends a frame.(Here, logical volume is a virtual area which is divided in pluralareas, and is given numbers (In contrast to physical volume).) Thisidentifier is called LUN (Logical Unit Numbers). In case if SCSI commandset is utilized, a command information called “command description block(CDB)” is contained in FCP_CDB 509. The Inquiry command information ofSCSI will be contained in FCP CDB 509, and will be transferred (togetherwith FCP_LUN 507) to a node that receives a frame.

Next, the information transferred, as a response to the Inquiry Command,to the frame transmitting unit, from the unit which has received theInquiry Command is explained. This information is called Inquiry Data.FIG. 6 shows a portion of the Inquiry Data. Here, two of the InquiryData 601, the Qualifier 602 and Device Type Code 603 are explained. TheQualifier (Peripheral Qualifier) 602 is 3-bit, for example, informationblock which sets the current status of the specified Logical Unit. TheLogical Unit status 604 indicates the status of the Logical Unit shownby the bit pattern of this Qualifier. The code 000 (binary) 605indicates that the unit connected as the logical unit is an Input/Outputdevice belonging to the type of unit defined by the Device Type Codefield 603. However, even if this code is set, this unit is notnecessarily usable, that is, ready to use.

However, if the specified Logical Unit can be used, a code 605 of 000 isset. The code 001 (binary) 606 indicates that the unit being connectedas a logical unit is an Input/Output device belonging to the type ofunit defined by the Device Type Code field 603. However, no actualInput/Output device is connected to the logical unit. An example of thiscase is that although a CD-ROM drive is installed but the CD-ROM mediumis not inserted into the drive.

The code 011 (binary) 607 indicates that the specified Logical Unit isnot supported. Therefore, no device is assigned to the specified LogicalUnit. When this code is set, 1F (hexadecimal) is always set in theDevice Type Code field 603.

Device Type Code (Peripheral Device Type) 603 comprises 5-bitsinformation, for example, which indicates the type of the Input/Outputdevice which is actually allocated to the specified Logical Unit. TheCode 608 is the code of the hexadecimal number which corresponds to eachDevice Type 609. If the Code 1F (hexadecimal) 610 which indicates anundefined or not connected device is set among the information includedin 608, the device inquired by the Inquiry Command transferring unit isundefined or not connected and therefore, the logical unit will not beused by the transferring unit.

FIG. 7 shows a representative procedure to query a Logical Unit usingthis Inquiry Command. The host computer 701 which attempts to access aLogical Unit transfers a frame 703 storing the Inquiry Command to thestorage subsystem 702 which has the Logical Unit to be accessed.

In this frame, contained are the S_ID of the host computer which hasbeen assigned in the PLOGI sequence and the LUN which is the identifierof the Logical Unit to be queried. Here, as for the LUN, it may be alsoset in the format of the Inquiry Command information in the FCP CDB inaddition to the FCP LUN area. The result is the same in either case,however, in this example embodiment, the value of LUN stored in the FCPLUN 507 is assumed to be used.

The storage subsystem 702 which received the frame containing theInquiry Command, prepares the required Inquiry Data for the receivedinquiry and transfers a frame 704 containing the prepared Inquiry Datato the host computer. The frame storing the Inquiry Data at this time iscalled FCP_DATA. When the host computer received the frame 704 havingeither the Qualifier 000 (binary) or Device Type in the range of 00-09(hexadecimal) set by the storage subsystem regarding the queried LogicalUnit, it may issue I/O Commands thereafter to the Logical Unit.

On the other hand, if the host computer received a frame 705 having theQualifier 001 (binary) or 011 (binary) and Device Type 1F (hexadecimal)set by the storage subsystem, it recognizes that no I/O operation may beissued thereafter to the Logical Unit.

From the above, it is understood that a storage subsystem can manage, byitself, whether to accept or reject each access from a host computer toa specified Logical Unit of the storage subsystem by controlling theQualifier and Device Type Code to be stored in the Inquiry Data. Next,details of the flow of processing in a representative embodimentaccording to the present invention will be explained.

FIG. 1 shows a subsystem configuration in which the present inventionmay be embodied. This subsystem is called storage subsystem 101. Thestorage subsystem 101 has ports 102-104 for the fibre channel interfaceand it is physically connected with host computers 105-107 via the fibrechannel interface. The host computers 105-107, also, have ports 108-112for the fibre channel interface, and the host computers 105-107 and astorage subsystem 101 can communicate with each other according to thefibre channel protocol. The host computer may have more than one fibrechannel ports like 105 or 106, or may have only one fibre channel portlike 107.

Although, to connect a storage subsystem 101 and the host computers105107, there exist some connection forms (Topology) of the fibrechannel interface such as Point-to-Point connection, Arbitrated LoopConnection and Fabric Connection, the present invention will beexplained simply referring to as the word ‘fibre channel’ 113, becausethe present invention does not depend on a specific Topology.

First, a storage subsystem 101 has microprocessors 114 to performvarious calculation and processing, more than two storage unit groups115, a storage control unit 116 to control the read/write operationfrom/to these storage units, a bus 117 to connect the storage unitgroups 115 and the storage control unit 116. Also, the storage subsystem101 has a memory unit 118 to be used as the work area of variouscalculation and processing and a non volatile memory unit 119 whichpreserves various management information or management tables and so on.Moreover, the subsystem has a cache memory unit 120 to enhance theresponse time to the host computers. Also, the storage subsystem 101 hasa communication control unit 121 and is connected with a maintenanceterminal unit 123 via a communication line 122.

The maintenance terminal unit 123 has a microprocessor 124 and an inputunit 125 as an interface with users and a display unit 126 to displaythe results of processing. The users can build some tables defined bythis embodiment utilizing this input unit 125.

FIG. 8 shows an outline of processing flow in a specific embodimentaccording to the present invention. FIG. 8 illustrates a step 801, inwhich the user creates an “LUN Access Management Table” which includesthe linkage information combining an LUN (Logical Unit Number) toidentify an LU that exists in the storage subsystem, the WWN (N PortName) allocated to the host computer which may access the LUN, and theVirtual LUN to decide how to show the LUN to the host computer using theinput unit 125 within the maintenance terminal. This table is maintainedin the non volatile memory 119, for example, in the storage subsystem.This Virtual LUN in this table is disclosed to each host computer. TheWWN of each host computer is known.

Next, in step 802, when each host computer initiates a LOGIN procedureto the storage subsystem according to the fibre channel protocol, thestorage subsystem extracts the WWN and S_ID allocated to the hostcomputer from the PLOGI frame, and creates the “WWN-S_ID ConversionTable,” which contains the combination of the WWN and S_ID, and storesthis table in the non volatile memory 119. The storage subsystem doesthis work for all received PLOGI frames.

Next, in step 803, the storage subsystem receives a frame which containsthe Inquiry Command transferred by the host computer to get the statusof the Logical Unit in the storage subsystem. The storage subsystem thatreceived this frame extracts the S_ID from the header of the frame andthe LUN which is to be a target of the Inquiry Command from the DataField. Next, the storage subsystem searches the “WWN-S_ID ConversionTable” using the SID as a key and obtains the WWN corresponding to thisS_ID as a key.

Next, in step 804, the storage subsystem searches the “LUN AccessManagement Table” using the WWN obtained as a key and obtains theVirtual LUN corresponding to the LUN that is a target of the InquiryCommand from the “LUN Access Management Table”. The reason why thestorage subsystem obtains the LUN that is a target of the InquiryCommand as a Virtual LUN is that only the Virtual LUN is disclosed tothe host computer.

Next, in step 805, storage subsystem makes a judgment whether theVirtual LUN corresponding to the WWN is actually obtained in the step804. When it has been obtained, i.e. the Virtual LUN corresponding tothe WWN does exist in the “LUN Access Management Table”, the hostcomputer is permitted to access to the Virtual LUN. When the requiredVirtual LUN doesn't exist in the Table, the host computer is refusedaccess to the LUN.

If the access to the Virtual LUN by the host computer is permitted instep 805, then, in step 806, the storage subsystem sends the InquiryData which has the setting that the target LU is installed (i.e.accessible) as a response to the Inquiry Command. On the other hand, ifthe access to the Virtual LUN specified by the host computer is refused,then, in step 807, the storage subsystem sends the Inquiry Data, whichhas the setting that the target LU is not installed (i.e. notaccessible), as a response to the Inquiry Command. The host computerwhich received the Inquiry data analyzes the frame.

After the host computer has recognized that the access to the VirtualLUN in the storage subsystem was permitted as a result of the analysis,the host computer may issue Commands (I/O Requests) continuously to theVirtual LUN. Furthermore, as shown in step 808, the storage subsystemcan continue to receive Commands without checking the accessibility ofthe LU so long as the LOGIN from the host computer is kept valid.

On the other hand, the host computer that recognized that the access tothe LUN was refused, does not access the corresponding LU so long as theLOGIN from the host computer is kept valid. Hereinafter, theabove-mentioned technique which controls the accessibility of thespecified LU in a storage subsystem by the host computer is called “LUNSecurity” for convenience. Next, the details about each of theabove-mentioned procedure are explained.

First, the creation of the “LUN Access Management Table” of the aboveprocedure is explained. The LUN Security in specific embodimentsaccording to the present invention is managed at each port of thestorage subsystem so that the host computer accesses the LU in thestorage subsystem through the port of this storage subsystem. In suchspecific embodiments, a technique in which a table 901, shown in FIG. 9,is established. Table 901 defines the correspondence of the WWN, whichis the information to identify a host computer, uniquely to the LUN(Logical Unit Number) in the storage subsystem permitted to be accessedby the host computer.

However, in an operational environment in which hubs or switches for thefibre channel exist between the host computers and the storagesubsystem, table 901 can be supplemented by further techniques accordingto the present invention, as explained below.

Table 901 directly allocates the LU in the storage subsystem accordingto the LUN (Logical Unit Number), which is an identifier of the LU tothe WWN of host computer. In the representative example illustrated inFIG. 9, a host computer WWN902 is permitted to access only LUO to LU2, ahost computer WWN903 is permitted to access only LUs3, 4, and 7 and ahost computer WWN904 is permitted to access only LUs 5, and 6. Forexample, the LUO to LU2 may not be accessed by the host computers otherthan that of the WWN902, and therefore, the LUN Security is realized.However, when the access to the LUO was rejected, the majority of modernhost computers do not inquire any further into the accessibility of theLUs belonging to the same series as LUO. For example, according to theSCSI1 or SCSI2 standard, one series comprises of 8 LUs, and thereforeLUO to LU7 comprise one series.

Then, so long as measures like that in Table 901 are used, the hostcomputer 903 or 904 happens not to inquire the LUNs even though theseLUNs are listed in the table 901 as permitted to be accessed by thesehost computers, because they could not access the LUO. This situation isquite serious for storage subsystems such as the disk array subsystemthat can provide abundant storage resources, because the coefficient ofutilization in such disk array subsystems will be decreased.

If the access to the LUO by the host computer 903 and 904 is permittedin order to avoid this problem, then the security of the LUO is notassured. Even if the security problem is not considered further, if thehost computer 903 and 904 have different operating systems, andtherefore have different types of storage formats, then, the LU0 cannotbe easily shared by both host computers.

On the other hand, in the FIG. 10, the host computers having WWNs10021004, which inquire all LUNs about their existence even if the LUOdoes not exist under the port to which the host computers are connected,are supposed to exist. In the representative example embodimentillustrated by FIG. 10, a host computer WWN1002 is permitted to accessonly LUsO, 1, and 7, a host computer WWN1003 is permitted to access onlyLUs3, 5, and 6 and a host computer WWN1004 is permitted to access onlyLUs2 and 4.

FIG. 11 shows the representative embodiment of FIG. 10 more visually.The host computers 1102-1104 correspond to the host computers WWNs1002to 1004 in FIG. 10. The host computers 1102-1104 are connected to thesame port 1106 of the storage subsystem through hubs and switches 1105for the fibre channel. In such an operational environment, if the LUNsare defined unsystematically or the LAN different from the former onesare assigned to the host computers 1102-1104, LUs under the port appearas if they are scattered and broken in fragments like LU group 1107.This condition can arise because storage subsystems like storagesubsystem 1101 disclose the LUNs in the storage subsystem as they arephysically arranged, having no flexible way to disclose the LUNs. Diskmanagement problems can be solved using the techniques according to thepresent invention as described herein below.

Recently, some host computers can accept more than 8 LUs defined under aport within the storage subsystem. The problems inevitable when the LUNSecurity is applied to a system containing both types of the hostcomputers such as new type of host computers accepting more than 8 LUsand conventional types of host computers only accepting maximum of 8LUs, LUO to LU7 are described below.

The description will be applied to the representative example embodimentillustrated by FIG. 12, in which the host computers corresponding toWWN1202 and WWN1204 have a mechanism with which to inquire each LU aboutits existence even if no LUO exists under the associated port of theconnected storage subsystem. Further, such host computers can recognizeup to 16 LUs under a single port of the connected storage subsystem.

Suppose that in a particular embodiment, the host computer havingWWN1203 can query each LU about its existence even if LUO does not existunder the port of the connected storage subsystem, however the LUssupported by the host computer is up to 8 ranging from LUO to LU7. Asshown in the Table 1201, the host computer having WWN1202 is permittedto access LUs in the range of LUO to LU5, the host computer havingWVVN1203 is permitted to access LUs in the range of LU6 to LUl0, and thehost computer having WWN1204 is permitted to access LUs in the range ofLU11 to LUIS. FIG. 13 illustrates a representative embodiment in whichthis condition exists.

FIG. 13 illustrates representative host computers 1302-1304 thatcorrespond to the host computers having WWN1202-1204 illustrated in FIG.12. The host computers 1302-1304 are connected to the same port, port1306 of the storage subsystem, through the hubs and switches for thefibre channel. In this environment, when LUs in the storage subsystem,such as LU group 1308, are assigned to each of host computers 1302-1304,the host computer A 1302 can recognize only the LUs0 to LU5 in the LUgroup 1308 as permissible to access, and the host computer C 1304 canrecognize only the LU11 to LU15 in the LU group 1308 as permissible toaccess, and therefore, the purpose of the LUN Security is satisfied sofar. However because the host computer B 1303 supports only up to 8 LUsranging from LU0 to LU7 under a port, it can inquire only within therange of LU group 1307. Therefore, in this case, the host computer B1303 can access actually only LU6 and LU7, even if LU6 to LU10 are setto be accessible to the host computer in table 1201. This problem isalso caused by directly disclosing the LUs in the storage subsystem asthey are arranged.

In a representative embodiment according to the present invention, a“LUN Access Management Table” 1401 is defined as illustrated in FIG. 14.The Table 1401 defines, for each port in the storage subsystem, acombination of an LUN in the storage subsystem, a Virtual LUN created byrenumbering the LUN according on the user's convenience, for example,and a WWN of the host computer likely to access the Virtual LUN. Thus,table 1401 is in contrast to the Table 901 in FIG. 9, the Table 1001 inFIG. 10, or the Table 1201 in FIG. 12 in which relationships aredepicted between physical LUNs and the WWNs.

In table 1401, the user can provide a Virtual LUN with correspondence toany number of LUNs using any of a plurality of assigning techniques,such as numbering or the like. As a result, the storage subsystem whichdefines this “LUN Access Management Table” 1401 can disclose any LUNsdepending on the user's convenience, for example, to the host computers.In such specific embodiments, because the LUN that is permitted to beaccessed by a host computer is not the real LUN 1417 but the Virtual LUN1416, it is no longer necessary to worry about the fragmentation of theLUN values and existence of LU0. Thus, specific embodiments can provideusers with optimum and flexible LUN combinations for meeting theirneeds.

In FIG. 14, the host computer having WWN 1402 is permitted to access thereal LUNs0-3 through the Virtual LUNs0-3. In the same way, the hostcomputers having WWNs1403-1414, are permitted to access the real LUNslisted in 1417 through the Virtual LUNs listed in 1416, respectively.Accordingly, each host computer can process LUs other than LUO in asubstantially similar way as that for LUN0.

A characteristic result caused by using this “LUN Access ManagementTable” 1401 is that the host computers having WWNs1402-1405 are capableof accessing the different LUNs resulting in effective use of thestorage resource. Further, exclusive access security can be providedbetween these host computers, even though each host computer looks as ifit is accessing the LUO under the connected port.

The details of the numbering of the Virtual LUN corresponding to theactual LUN are shown. The numbering schema that the most users arelikely to use is to increment the value by 1 for each WWN starting fromLUO as shown in WWNs1402-1404, taking the correspondence to thetraditional SCSI standard in consideration.

However, in some applications, it may be preferred to use only oddnumbers or even numbers of the Virtual LUNs like those in WWN1407 orWWN1408. In those cases, the host computer having WWN1407 or WWN1408 isactually permitted to access LUs with the consecutive numbers, LUs30 to34 or LUs35 to 38, respectively. Also, if a host computer can access anyLUN without accessing LUO, like WWN1409, it is enough to permit accessto only the Virtual LUN corresponding to the requested LUN. Also, thecorrespondence like WWN1410 and WWN1411 is convenient when two or moredifferent host computers are to be grouped optionally. Additionally, inthe cases of WWN1412 and WWN1413, both host computers share the samereal LUNs and receive the same information, even though they look as ifthey are permitted to access the different LUNs. This can provide usefuloperations in specific embodiments.

Moreover, in the case of a storage subsystem comprising of a RAID madeby arrayed disk groups, it is possible to assign one LU to eachdifferent RAID group and to increase the number of storage units(magnetic disk drives) which contribute to the I/O performance. TheWWN1414 in FIG. 14 illustrates this technique.

The effectiveness of assigning a Virtual LUN to a real LUN using the“LUN Access Management Table” has been explained herein above withreference to representative specific embodiments according to thepresent invention. FIG. 16 shows specific embodiments employing suchtechniques according to the invention. The corresponding managementtable is shown in FIG. 15.

The real LU group 1504 allocated to each host computer in the table 1501has a substantially unordered arrangement as illustrated by 1608 in FIG.16. However, by replacing these actual LUs with of the Virtual LU group1503 in the table 1501, each host computer may have the LUs disclosed asillustrated by 1607, independent of the real arrangements 1608 in thestorage subsystem 1601. Accordingly, the flexible operation of thestorage subsystem resource becomes possible.

The “LUN Access Management Table” 1401 and 1501 of the present inventionis maintained in the non volatile memory in the storage subsystem afterit is defined to the ports of the storage subsystem as shown in steps1701 to 1703 in FIG. 17. Residing in the non volatile memory, thecontent of this table is not lost even if the electric power is removedfrom the storage subsystem.

Next, the processing when a storage subsystem receives a LOGIN procedurefrom a host computer is explained. In a specific embodiment, through aseries of LOGIN processing steps, the S_ID, which uniquely identifiesthe host computer after the LOGIN procedure, is linked to the WWN, whichuniquely identifies the host computer. When the host computer isinitiated, the storage subsystem receives a PLOGI frame, as illustratedby step 1801 in FIG. 18.

The storage subsystem that has received the PLOGI frame fetches the S_IDof the host computer from the Frame Header in step 1802. Then, thestorage subsystem fetches the WWN (N_Port_Name) of the host computerfrom the Data Field in step 1803. Next, the storage subsystem registersthe received WWN and S_ID pair into the “WWN-S ID Conversion Table” 1901in step 1804 of FIG. 19. This table is maintained in the non volatilememory in step 1805. The “WWN-S_ID Conversion Table” 1901 is preparedfor each port of the storage subsystem.

According to this technique, when a Command is transferred from a hostcomputer having the WWN registered in the table thereafter, the storagesubsystem extracts the S_ID from the received Frame Header, and thensearches the “WWN-SID Conversion Table” 1901 for the WWN allocated tothe host computer.

After the “W WN-S ID Conversion Table” is stored in the non volatilememory, the storage subsystem transfers an ACC frame in step 1806 inorder to notify host computer that the LOGIN has been accepted. Afterthe host computer receives the ACC frame from the storage subsystem, itcan issue an Inquiry Command to the storage subsystem.

Next, a procedure used by the storage subsystem to receive the InquiryCommand from the host computer and the responses made by the storagesubsystem in order to provide security are explained. FIG. 20A and FIG.20B show the flow representative processing and FIG. 21 shows thereferencing relation of each table and the parameter used in the flow ofsuch processing. In step 2001 in FIG. 20A, the storage subsystemreceives the FCP_CMND frame specified by the fibre channel from the hostcomputer. Then, the storage subsystem analyzes the contents of the DataFrame of the FCP_CMND in step 2002.

Next, the storage subsystem checks whether the content of the FCP CMNDis an Inquiry Command in step 2003. In the case that it is not theInquiry Command, the storage subsystem executes the appropriateprocessing corresponding to the command in step 2004. Otherwise, in thecase of the Inquiry Command, the storage subsystem extracts the S_ID ofthe host computer from the header of the FCP_CMND Frame in step 2005.The targeted LUN is extracted from the FCP_LUN in Data Field of theFCP_CMND Frame in step 2006. Then, the storage subsystem searches the“WWNS_ID Conversion Table” 1901 in FIG. 19 for the WWN corresponding tothis S_ID using the S_ID as a key in step 2007. The operational flowdescribed is illustrated by the referencing operations of 2101 and steps2102 and 2103 in FIG. 21.

Next, the storage subsystem attempts to acquire the Virtual LUNinformation which it is permitted to access using this WWN in step 2008.Then, it judges whether the LUN obtained from the Inquiry Command fromthe host computer having the WWN, is registered as a Virtual LUNpermitted to access in the “LUN Access Management Table”, in step 2009.The operational flow described herein is illustrated by referencingoperation of 2104 and 2105 in FIG. 21.

If the LUN obtained in step 2006 is registered as the Virtual LUN in theentry of the “LUN Access Management Table,” then the host computer ispermitted to access the Virtual LUN. Accordingly, the storage subsystemsets 000 (binary) in the Qualifier and Device Type Code corresponding tothe storage subsystem in the Device Type in the Inquiry Data for theresponse to the host computer in step 2010.

Otherwise, if the LUN obtained in step 2006 is not registered as theVirtual LUN in the entries of the “LUN Access Management Table,” then,the host computer's requested access to the Virtual LUN is rejected.Accordingly, the storage subsystem sets ‘001’ or ‘011’ (binary) in theQualifier and Device Type Code 1F (hexadecimal) in the Device Type inthe Inquiry Data for the response to the host computer in step 2010.

The storage subsystem sets above-mentioned Inquiry Data for response tothe Inquiry Command in the FCP_DATA Frame in step 2012 and transfers itto the host computer. Next, the storage subsystem transfers the FCP_RSPFrame which notifies the host computer that the response to the InquiryCommand has completed in step 2013.

Following the steps 2010 and 2012 in FIG. 20A, the host computer whichreceived the FCP DATA containing the Inquiry Data from the storagesubsystem, understands that the LUN is accessible, and may continue toaccess the LUN without inquiring about the accessibility of the VirtualLUN any more. The LUN accessed by the host computer is actually the LUNof step 2106 in FIG. 21. The reference operation in step 2106 is theinternal reference work in the storage subsystem and the host computeris not required to worry about it. On the other hand, the host computerwhich received the FCP DATA containing Inquiry Data from the storagesubsystem following steps 2011 and 2012 in FIG. 20A, understands thatthe LUN is not accessible, and thereafter will not access the VirtualLUN also, without inquiring about the accessibility of it any more.

According to a particular embodiment of the present invention, the hostcomputer queries the LUN to determine the LUN's accessibility when thehost issues an Inquiry Command. In other words, while the LOGIN isvalid, any more repeated inquiry is not required. Thus, specificembodiments employing such techniques can achieve strong LUN Securitywithout sacrificing data transfer efficiency between the host computersand a storage subsystem.

As described herein above, specific embodiments according to the presentinvention can realize highly reliable LUN Security, and can provide thehost computers with efficient utilization of the storage resources inthe storage subsystem and fast judgment logic to check the accessibilityof the LUN. Such specific embodiments can insure that, for each port inthe storage subsystem: at least one LU exists in the storage subsystem,a Virtual LUN created by arbitrarily renumbering the actual LUN, and theWWN of the host computer which is likely to access the Virtual LUN.Further, no modification on the host computer side is required for thecurrent operational procedures.

In the representative example embodiments described herein above, thefibre channel has been employed to provide a protocol between the hostcomputer and the storage subsystem, however, fibre channel is notrequired to realize specific embodiments according to the presentinvention. Rather, any applicable protocol environment providingsubstantially similar function can be used in various specificembodiments. Also, as for the storage subsystem, disk array subsystem ismainly described in this example embodiment, however, the presentinvention is also applicable to storage subsystem such as the opticaldisk library and the magnetic tape library by replacing the storagemedia with removable ones.

Next, yet further representative embodiments according to the presentinvention will be described below. Specific embodiments according to thepresent invention can provide techniques for realizing the LUN Securityto the specific group comprising one or more host computers. Thespecific embodiments described herein below will be explained based uponthe fibre channel as an interface protocol between the host computersand a storage subsystem, however, such fibre channel interface is notrequired in these embodiments.

In the environments shown in FIG. 1, FIG. 11, FIG. 13, and FIG. 16,having hubs, switches or other devices for the fibre channel, the hostcomputers made by various vendors are expected to access the same portof the storage subsystem. In the environment in which the host computersmade by such various vendors coexist, problems can occur concerningsharing of the storage resources in a storage subsystem. If the vendorsare different, OS's installed on the host computers are often different.This condition often occurs if the host computers belong to work station(WS) or Mainframe type and the like. When the host computers are PCtype, even if the vendors are different, because the OS's are in manycases Windows families, this condition occurs less frequently.

When the OS's are different, the recording formats, the access logic,the executable scripts, and the applications for the storage resourcesare often different, as well. Therefore, it is difficult to share avolume among such host computers made by different vendors.

Therefore, it is desirable to realize the LUN Security function so thatthe accessibility to the storage resource is defined for each group ofhost computers made by a particular vendor. Moreover, in specificembodiments which provide such an LUN Security, the storage subsystemcan provide the host computer group permitted to access with exclusiveservices or specific functions in the storage resource.

Therefore, in a specific embodiment, a representative example includesdefinitions to permit access to the LUs in the storage subsystemdepending on the vendor of the host computers, for example. In somerepresentative embodiments, the “LUN Access Management Table” can bedefined to include vendor information, or other grouping information. Inspecific embodiments, the vendor of a host computer can be recognizedbased upon the WWN, for example. The 2201 in FIG. 22 shows one of theformats for a WWN. As shown in this figure, representative WWN2201 iscomprised of an Identifier Field 2202 defined by a bit area 60-63 (4-bitarea), for example, a Company ID 2203 defined by a bit area of 36-59(24-bit area), for example, and a VSID (Vendor Specific Identifier) 2204defined by a bit area of 0-35 (36-bit area), for example.

In a specific embodiment, Company_ID 2203 can be a global identityinformation allocated by IEEE to uniquely identify each computer andcommunication equipment vendor all over the world. The VSID 2204 is theunique identity information uniquely defined by the vendor and approvedby IEEE to use the Company_ID 2203. As any one may know this Company_IDof each vendor by checking the publications of IEEE, the storagesubsystem can know the vendor of the host computer attempting a LOGIN tothe storage subsystem, if the Company_ID is known.

Although several kinds of formats are specified for the WWN standard,the Company_ID 2203 and VSID (Vendor Specific Identifier) 2204 arecommonly included.

FIG. 23 illustrates a representative “LUN Access Management Table” 2301in a particular embodiment according to the present invention. The “LUNAccess Management Table” 2301 is defined for each port of the storagesubsystem and comprises a LUN 2304 in the storage subsystem, a VirtualLUN 2303 created from the LUN by renumbering it by the user in thearbitrary schema, and a Company_ID 2302 of the host computer which islikely to access the Virtual LUN. Using this table 2301, users may linkthe Virtual LUN with any number of LUNs using any numbering schema.

Accordingly, in the storage subsystem which defined this “LUN AccessManagement Table” 2301, the LUN can be disclosed to the host computermade by each vendor in accordance with the users convenience. In thiscase, since the LUN access by the host computer of each vendor is notbased upon the real LUN 2304 but the Virtual LUN 2303, it is notnecessary to worry about the fragmentation of the LUN values andexistence of LU0. Thus, users may be provided with optimum and flexibleLUN combination meeting their demands. Additionally, the “WWN-SIDConversion Table” can be built in the same way as shown in FIG. 18,using the similar formats shown in FIG. 19.

FIG. 24 shows representative processing flows of a particular embodimentaccording to the present invention, and FIG. 25 shows referencingrelations of each table and the parameter used in the flow of thisprocessing. At first, the user creates the “LUN Access Management Table”using the input unit 125 of the maintenance terminal unit 123 in step2401. The LUN Access Management Table describes relationships betweenthe LUNs existing in the storage subsystem, the Company_ID, whichidentifies the vendor of host computers likely to access the LUN, andthe Virtual LUN, which determines how the LUNs appear to the hostcomputers likely to access the LUN.

In a specific embodiment, this table is maintained in the non volatilememory 119 in the storage subsystem, for example. In this table, theVirtual LUN, rather than the actual LUN, is disclosed to the hostcomputer. The Company_ID, which identifies each vendor, is alreadyknown. One reason access is determined based upon the Company_ID, notthe WWN, in the “LUN Access Management Table” of this embodiment is thatthe accessibility of the LU should be decided not on a host computerbasis but rather based upon the vendor of each host computer.

In step 2402, when a host computer issues a LOGIN to the storagesubsystem, depending on the fibre channel protocol, the storagesubsystem fetches the N_Port Name, called WWN hereinafter, and the S_IDfrom the PLOGI frame and creates a “WWN-S ID Conversion Table” whichcontains the combination of them. This table can be stored in the nonvolatile memory 119. The storage subsystem does this for all the PLOGIframes received.

Next, in step 2403, the storage subsystem receives the frame containingthe Inquiry Command transferred by the host computer in order todetermine the status of the Logical Units in the storage subsystem. Thestorage subsystem which receives this frame extracts the S_ID from theFrame Header and the LUN, which is a target of this command, from theData Field. Then, the storage subsystem searches the “WWN-S_IDConversion Table” for the WWN corresponding to this S_ID by using theSID as a search key.

Next, in step 2404, the storage subsystem extracts the Company_ID,comprising 24 bits in this specific embodiment, from the obtained WWNbased on the format 2201 in FIG. 22. The operation to extract thisCompany_ID is specific to this particular embodiment, and it is thus notneeded in other embodiments. Step 2403, 2404 correspond to 2501-2504 inFIG. 25.

Next, the storage subsystem searches the “LUN Access Management Table”using the obtained Company JD as a search key and obtains a Virtual LUNcorresponding to the LUN that is a target of the Inquiry Command. Thereason for obtaining the LUN that is a target of the Inquiry Command asa Virtual LUN is that the Virtual LUN is disclosed to the host computeras the LUN in the storage subsystem.

Next, in step 2406, a judgment is made whether the Virtual LUNcorresponding to the WWN was obtained in step 2405 or not. If it wasobtained, or the Virtual LUN corresponding to the WWN was found in the“LUN Access Management Table”, the Virtual LUN is permitted to beaccessed by the host computer. If it was not obtained, the hostcomputer's access attempt of the Virtual LUN is rejected.

If the Virtual LUN is found to be accessible by host computers made bythe vendor as the result of step 2406, the storage subsystem transfersthe Inquiry Data in step 2407 with the status set to indicate that theinquired LU is installed and the access is permitted as a response tothe Inquiry Command issued by the host computer. These steps 2405, 2406,and 2407 correspond to 2505, 2506, and 2508 in FIG. 25.

On the other hand, if the Virtual LUN is determined to be inaccessibleby host computers made by the vendor as the result of the step 2406, thestorage subsystem transfers the Inquiry Data, in step 2408, with thestatus set to indicate that the inquired LU is not installed and theaccess is rejected as a response to the Inquiry Command issued by thehost computer. The host computer which received the Inquiry Dataanalyzes the frame.

If the host computer made by the Vendor, found that the access to theVirtual LUN was permitted after the analysis of the frame, the hostcomputer can issue commands (I/O Request) to the Virtual LUNcontinuously. In this case, as shown in the step 2409, the storagesubsystem can continue to receive commands from the host computer madeby the vendor, without checking the accessibility of the Virtual LUN solong as the LOGIN from the host computer made by the vendor is valid.The LUN permitted to be accessed by the host computer made by the vendoris actually the LUN in the storage subsystem uniquely corresponding tothe Virtual LUN which is pointed in the reference operation in step 2507in FIG. 25. The reference operation in this step 2507 is the internalreference work in the storage subsystem and the host computer does notneed to worry about it. Otherwise, if the host computer made by thevendor recognized the LU access was rejected, it does not access to theLUN any more, so long as the LOGIN is valid.

In this embodiment, it is clear that the WWN of each host computerrequesting access to the storage subsystem is not the object of thesecurity. However, the vendor, that is, the group to which the hostcomputer belongs is identified by obtaining the Company_ID comprisingthe WWN and treating the vendor as the object of the security.

This embodiment is explained in more detail with reference to FIG. 26and FIG. 27. The “LUN Access Management Table” 2601 permits the hostcomputer group 2605, having Company_ID 0000E1, to access the actual LUNs0, 1, 6, 8, and 15 through the Virtual LUNs 0, 1, 2, 3, and 4. In thesame way, Table 2601 permits the host computer group 2606, havingCompany_ID 0000E2, to access the real LUNs 2, 7, and 10 through theVirtual LUNs 0, 1, and 2. Further, Table 2601 permits the host computergroup 2607, having Company_ID 0000F0, to access the real LUNs 3, 4, 5,and 14 through the Virtual LUNs 0, 1, 3, and 4.

FIG. 27 illustrates this. Various host computers 2703-2711 are connectedto the single port of the storage subsystem 2701 via the fabric 2702 offibre channel. Each of host computers 2703-2711 has a WWN, unique in theworld. However, the host computers made by the same vendor have commonCompany_ID. The host computers 2703, 2704, 2705, and 2708 are made bythe same vendor A and assumed to have Company_ID 0000E1. These hostcomputers are permitted to access only the LUAO to LUA4 according to thesecurity setting in the “LUN Access Management Table” 2701, even thoughthese host computers belong to different domains from each other.

In the same way, the host computers 2706, 2707, and 2711 are made by thesame vendor B, and have, for example, a Company_ID of 0000E2. Then,these host computers are permitted to access only the LUBO to LUB2 inthe storage subsystem 2701 according to the security setting in thetable 2601, even though these host computers belong to different domainsfrom each other. Also, the host computers 2709 and 2710 are made by thesame vendor C and have, for example, Company_ID of 0000F0. Then thesehost computers are permitted to access only the LUCO to LUC3 in thestorage subsystem 2701 according to the security setting in the table2601, even though these host computers belong to different domains fromeach other. Among the different vendors of the host computers, aparticular host computer blocked from accessing any LU permitted to theother vendors because of the exclusive mechanism based on the securitysetting in the Table 2601.

The LUN Security for each vendor of the host computers can be realizedas described herein above. In specific embodiments, techniques forproviding LUN Security can enable the storage subsystem to provide hostcomputers of each vendor access to storage resources more efficiently.For example, because it is clear that the LUA0 to LUA4, LUB0 to LUB2,and LUC0 to LUC3 in 2712 are accessed by the different vendorsrespectively, the storage subsystem can provide host computers of eachvendor permitted to access with appropriate storage format tailored tothe OS operating in the host computer of each vendor. Also, the storagesubsystem can provide OS of the host computers of each vendor with thespecifically tailored executive scripts, application software, andservice operations. Moreover, the storage subsystem 2701 may beindividually customized by providing each vendor with the controlinformation of its own.

As described herein above, specific embodiments can achieve highlyreliable LUN Security, which can provide the host computers withefficient utilization of the storage resources in the storage subsystem.Specific embodiments can comprise fast judgment logic to check theaccessibility of the specified LUN, with little or no modificationneeded in the processing in the host computers by insuring that, foreach port in the storage subsystem, an actual LU exists in the storagesubsystem, a Virtual LUN created by redefining to the LU using arbitrarynumbering, and a Company_ID of the vendor of the host computer which islikely to access the Virtual LUN are provided.

In this example embodiment, the fibre channel was used as an exampleinterface protocol between one or more host computers and a storagesubsystem, however it is not required. In fact, embodiments according tothe present invention can employ any protocol environment providingsubstantially similar functionality. Also, the present invention hasbeen described with reference to example embodiments employing diskarrays as the storage subsystem, however, the present invention isapplicable to other types of storage subsystems, such as optical disklibrary, and a magnetic tape library by replacing the disk storage withappropriate media. Moreover, grouping of the host computers wasdescribed on the basis of grouping by vendor of the host computers,however, the grouping can be done on the basis of any informationsharable among two or more host computers.

The preceding has been a description of the preferred embodiment of theinvention. It will be appreciated that deviations and modifications canbe made without departing from the scope of the invention, which isdefined by the appended claims.

Although the above has generally described the present inventionaccording to specific systems, the present invention has a much broaderrange of applicability. In particular, while foregoing has described aspecific embodiments having a fibre channel as an interface protocolbetween a storage subsystem and host computers, and the SCSI command setas a command interface operational under the interface protocol, asexamples. However, the application of the present invention is notlimited to the combination of the fibre channel and SCSI command set.Any protocol which provides similar function and structure of LOGIN,Inquiry, and the like may be used in various specific embodimentsaccording to the present invention.

The specific embodiments described herein are intended to be merelyillustrative and not limiting of the many embodiments, variations,modifications, and alternatives achievable by one of ordinary skill inthe art. Further, the diagrams used herein are merely illustrations andshould not limit the scope of the claims herein. One of ordinary skillin the art would recognize other variations, modifications, andalternatives. Thus, it is intended that the foregoing description begiven the broadest possible construction and be limited only by thefollowing claims.

1. A storage system, comprising: a processor, in response to receiving afirst frame from at least one computer of a plurality of computersaccording to a fibre channel protocol, being adapted to send a secondframe to the at least one computer of the plurality of computersaccording to said fiber channel protocol; wherein, if the first frame isreceived from a first computer and includes a first virtual logical unitnumber (LUN), which corresponds to a first LUN identifying a first LUwhich is accessible by the first computer, the storage system is adaptedto send the second frame wherein the first virtual LUN is 0, and thesecond frame includes first information indicating that the first LU,related to the first virtual LUN is installed in the storage system,wherein, if the first frame is received from a second computer of theplurality of computers, other than the first computer, and includes asecond virtual LUN, which does not relate to any LU that is accessibleby the second computer, the storage system is adapted to send the secondframe, the second frame including second information indicating that thesecond LU, related to the second virtual LUN, is not installed in thestorage system, wherein, if the first frame is received from a thirdcomputer, other than the first and second computers, and includes athird virtual LUN, which corresponds to a third LUN, different from thefirst LUN, identifying a third LU which is accessible by the thirdcomputer, the storage system is adapted to send the second frameincluding third information, wherein third virtual LUN is 0, and thethird information indicates that the third LU, related to the thirdvirtual LUN, is installed in the storage system.
 2. A storage systemaccording to claim 1, wherein, the first frame includes an S_ID of thefirst computer, the second computer or the third computer of theplurality of computers; the second frame including first information isadapted to be sent based on data relating the first virtual LUN to afirst S_ID of the first computer.
 3. A storage system according to claim1, wherein the storage system is adapted to use the S_ID included in thefirst frame for obtaining a WWN, corresponding to the S_ID included inthe first frame, and corresponding to the S_ID included in the firstframe.
 4. A storage system according to claim 1, wherein: the firstinformation identifies that the first LU related to the first virtualLUN included in the first frame is accessible by an I/O command, and thesecond information identifies that the first LU related to the firstvirtual LUN included in the first frame is not accessible by an I/Ocommand.
 5. A storage system according to claim 1, wherein: the storagesystem is adapted to continue to receive I/O requests to the firstvirtual LUN after sending the second frame.
 6. A storage systemaccording to claim 1, wherein: the storage system is adapted to continueto receive I/O requests to the first virtual LUN without checking theaccessibility of the first LU after sending the second frame.
 7. Astorage system according to claim 1, wherein: the first frame includes acommand that is supported in a SCSI command set.
 8. A storage systemaccording to claim 1, wherein: the first identifier addresses a port ofthe first computer.
 9. A storage system according to claim 1, wherein:the processor is adapted to send the second frame.
 10. A storage system,comprising: a processor controlling to receive a first frame, which isused to inquire about the status of a logical unit (LU), and receivedfrom a port of one of a plurality of computers according to a fibrechannel protocol, the first frame including a virtual logical unitnumber (LUN) for a LUN identifying the logical unit, and, in response toreceiving the first frame, the processor controlling to send a secondframe to the port of the one of the plurality of computers, wherein thesecond frame includes a code of Qualifier, and wherein the code ofQualifier differs based on whether or not the port of the one of theplurality of computers is permitted to access the LU related to thevirtual LUN, and wherein a first virtual LUN, for a first LUNidentifying a first LU that is permitted to be accessed by a first portof one of the plurality of computers, is 0, and wherein a second virtualLUN, for a second LUN that is different from the first LUN andidentifies a second LU which is permitted to be accessed by a secondport of one of the plurality of computers, is also
 0. 11. A storagesystem according to claim 10, further comprising: a memory being adaptedto store a first information, indicating whether or not the port of theone of the plurality of computers is permitted to access the LU relatedto the virtual LUN, before receiving the first frame.
 12. A storagesystem according to claim 10, wherein: the processor controls to send,if the port of the one of the plurality of computers is permitted toaccess the LU related to the virtual LUN, the code of Qualifieridentifying that the LU related to the virtual LUN is installed in thestorage system, and the processor controls to send, if the port of theone of the plurality of computers is not permitted to access the LUrelated to the virtual LUN, the code of Qualifier identifying that theLU related to the virtual LUN is not installed in the storage system.13. A storage system according to claim 12, wherein: the first frameincludes an S_ID of the port of the one of the plurality of computers.14. A storage system according to claim 13, wherein: the processorcontrols to use the S_ID included in the first frame for obtaining a WWNcorresponding to the S_ID included in the first frame; and the processorcontrols to use the obtained WWN and the virtual LUN included in thefirst frame for creating the code of Qualifier.
 15. A storage systemaccording to claim 10, wherein: the processor controls to send, if theport of the one of the plurality of computers is permitted to access theLU related to the virtual LUN, the code of Qualifier identifying thatthe virtual LUN included in the first frame is accessible by an I/Ocommand.
 16. A storage system according to claim 15, wherein: theprocessor controls to send, if the port of the one of the plurality ofcomputers is not permitted to access the LU related to the virtual LUN,the code of Qualifier identifying that the virtual LUN included in thefirst frame is not accessible by an I/O command.
 17. A storage systemaccording to claim 10, wherein: the processor controls to continue toreceive I/O requests to the virtual LUN after sending the second frame,if the code of Qualifier identifies that the virtual LUN included in thefirst frame is accessible by I/O requests.
 18. A storage systemaccording to claim 10, wherein: the processor controls to continue toreceive I/O requests to the LUN without checking the accessibility ofthe LU related to the virtual LUN after sending the second frame, if thecode of Qualifier identifies that the LU related to the virtual LUN isinstalled in the storage system.
 19. A storage system according to claim10, wherein: the first frame includes a command that is supported in aSCSI command set.
 20. A method of controlling a storage system,comprising: a step for receiving a first frame, which is used to inquireabout the status of a logical unit (LU), from a port of one of aplurality of computers according to a fibre channel protocol, the firstframe including a logical unit number (LUN) corresponding to a logicalunit identifier, the logical unit identifier identifying the LU in thestorage system; a step for sending a second frame to the port accordingto said fibre channel protocol in response to the first frame; wherein acode of Qualifier included in the second frame differs based on whetheror not the port of the one of the plurality of computers is permitted toaccess the LU related to the LUN, and wherein a first LUN, correspondingto a first logical unit identifier identifying a first LU that ispermitted to be accessed by a first port of one of the plurality ofcomputers, is 0, and wherein a second LUN, different from the first LUNand corresponding to a second logical unit identifier identifying asecond LU that is permitted to be accessed by a second port of one ofthe plurality of computers, is also
 0. 21. A method of controlling astorage system according to claim 20, further comprising: a step forstoring a first information, indicating whether or not the port of theone of the plurality of computers is permitted to access the LU relatedthe LUN, before receiving the first frame.
 22. A method of controlling astorage system according to claim 20, wherein: if the port of the one ofthe plurality of computers is permitted to access the LU related to theLUN, the code of Qualifier identifies that the LU related to the LUNincluded in the first frame is installed in the storage system, and ifthe port of the one of the plurality of computers is not permitted toaccess the LU related to the LUN, the code of Qualifier identifies thatthe LU related to the LUN included in the first frame is not installedin the storage system.
 23. A method of controlling a storage systemaccording to claim 22: wherein the first frame includes an S_ID of theport of the one of the plurality of computers.
 24. A method ofcontrolling a storage system according to claim 23, further comprising:a step for using the S_ID included in the first frame, a step forobtaining a WWN corresponding to the S_ID included in the first frame;and a step for using the obtained WWN and the LUN included in the firstframe for preparing the code of Qualifier.
 25. A method of controlling astorage system according to claim 20, wherein: if the port of the one ofthe plurality of computers is permitted to access the LU related to theLUN, the code of Qualifier identifies that the LUN included in the firstframe is accessible.
 26. A method of controlling a storage systemaccording to claim 25, wherein: if the port of the one of the pluralityof computers is not permitted to access the LU related to the LUN, thecode of the Qualifier identifies that the LUN included in the firstframe is not accessible by an I/O command.
 27. A method of controlling astorage system according to claim 20, further comprising: a step forcontinuing to receive I/O requests to the LUN after sending the secondframe, if the code of the Qualifier identifies that the LUN included inthe first frame is accessible by I/O requests.
 28. A method ofcontrolling a storage system according to claim 20, further comprising:a step for continuing to receive I/O requests to the LUN withoutchecking the accessibility of the LU related to the LUN after sendingthe second frame, if the code of the Qualifier identifies that the LUrelated to the LUN is installed in the storage system.
 29. A method ofcontrolling a storage system according to claim 10, wherein: the firstframe includes a command that is supported in a SCSI command set.
 30. Adata object to be stored in a memory unit within a storage system, thedata object comprising: a code for receiving a first frame, which isused to inquire about the status of a logical unit (LU), from a port ofone of a plurality of computers according to a fibre channel protocol,the first frame including a logical unit number (LUN), which correspondsto a logical unit identifier identifying the LU; and a code for sendinga second frame to the port according to said fibre channel protocol inresponse to the first frame; wherein a Qualifier information in thesecond frame differs based on whether or not the port is permitted toaccess the logical unit related to the LUN, and wherein a first LUN,corresponding to a first logical unit identifier identifying a first LUthat is permitted to be accessed by a first port of one of the pluralityof computers, is 0, and wherein a second LUN, different from the firstLUN and corresponding to a second logical unit identifier identifying asecond LU that is permitted to be accessed by a second port of one ofthe plurality of computers, is also
 0. 31. A data object to be stored ina memory unit within a storage system according to claim 30, furthercomprising: a code for storing a first data linking an LUN, a logicalunit identifier and a World Wide Name (WWN) of a port of one of theplurality of computers before receiving the first frame, the first databeing used for preparing the second frame.
 32. A data object to bestored in a memory unit within a storage system according to claim 30:the data object further comprising: a code for sending, if the firstframe is received from the first port, the second frame including firstinformation, the first information identifying that the first logicalunit related to the first LUN included in the first frame is installedin the storage system, a code for sending, if the first frame isreceived from the second port, the second frame including a secondinformation, the second information identifying that the second logicalunit related to the second LUN included in the first frame is installedin the storage system, and a code for sending, if the first frame isreceived from a third port of one of the plurality of computers which isnot permitted to access the first logical unit related to the first LUN,the second frame including a third information, the third informationidentifying that the first logical unit related to the first LUNincluded in the first frame is not installed in the storage system. 33.A data object to be stored in a memory unit within a storage systemaccording to claim 31: wherein the first frame includes an S_ID of theport of one of the plurality of computers; the data object furthercomprising: a code for storing a second data linking a first S_ID of thefirst port and the first WWN; a code for sending, if the first frame isreceived from the first port, the second frame including the firstinformation based on the first data and the second data.
 34. A dataobject to be stored in a memory unit within a storage system accordingto claim 33, the data object further comprising: a code for searchingthe second data using the S_ID included in the first frame, a code forobtaining a WWN corresponding to the S_ID included in the first framebased on the second data; and a code for searching the first data usingthe obtained WWN and the first LUN included in the first frame.
 35. Adata object to be stored in a memory unit within a storage systemaccording to claim 34, further comprising: a code for making a judgmentwhether or not a LUN, corresponding to the obtained WWN and being in thefirst data, is the LUN included in the first frame in order to send thesecond frame.
 36. A data object to be stored in a memory unit within astorage system according to claim 30: the data object furthercomprising: a code for sending, if the first frame is received from thefirst port, the second frame including a first information, the firstinformation identifying that the first logical unit related to the firstLUN included in the first frame is accessible, and a code for sending,if the first frame is received from the second port, the second frameincluding a second information, the second information identifying thatthe second logical unit related to the second LUN included in the firstframe is accessible.
 37. A data object to be stored in a memory unitwithin a storage system according to claim 36, further comprising: acode for sending, if the first frame is received from a third port ofone of the plurality of computers which is not permitted to access thefirst logical unit related to the first LUN, the second frame includinga third information, the third information identifying that the firstlogical unit related to the first LUN included in the first frame is notaccessible.
 38. A data object to be stored in a memory unit within astorage system according to claim 30, further comprising: a code forcontinuing to receive I/O requests to the first LUN after sending thesecond frame including a first information, the first informationidentifying that the first logical unit related to the first LUNincluded in the first frame is accessible.
 39. A data object to bestored in a memory unit within a storage system according to claim 30,further comprising: a code for continuing to receive I/O requests to thefirst LUN without checking the accessibility of the first logical unitafter sending the second frame including a first information, the firstinformation identifying that the first logical unit related to the firstLUN included in the first frame is accessible.
 40. A data object to bestored in a memory unit within a storage system according to claim 30,wherein: the first frame includes a command that is supported in a SCSIcommand set.